HackDig : Dig high-quality web security articles for hacker

As if people didn't already have cause to distrust the security of Juniper products, the networking gear maker just disclosed a vulnerability that allowed attackers to eavesdrop on sensitive communications traveling through customers' virtual private networks.

In an advisory posted Wednesday, Juniper officials said they just fixed a bug in the company's Junos operating system that allowed adversaries to masquerade as trusted parties. The impersonation could be carried out by presenting a forged cryptographic certificate that was signed by the attacker rather than by a trusted certificate authority that normally vets the identity of the credential holder.

"When a peer device presents a self-signed certificate as its end entity certificate with its issuer name matching one of the valid CA certificates enrolled in Junos, the peer certificate validation is skipped and the peer certificate is treated as valid," Wednesday's advisory stated. "This may allow an attacker to generate a specially crafted self-signed certificate and bypass certificate validation."

While the flaw resided in Junos, the validation failure was limited to certificates used for Internet Key Exchange/Internet Protocol Security, a complex set of standards that's largely reserved for end users and servers to prove their identity on VPNs. IPK/IPSec provides several different ways for parties to authenticate themselves, including one that uses the same types of X.509 digital certificates used to secure HTTPS Web connections.

"It seems that Junos was accepting specially crafted, invalid certificates as trusted," said Stephen Checkoway, a computer scientist at the University of Illinois at Chicago who recently focused on security in Juniper products. "This would enable anyone to create a VPN connection and gain access to the private network, e.g., a private, corporate network."

One of the methods enabling the encryption backdoor was use of the Dual_EC_DRBG random number generator, which was developed by the National Security Agency. Security researchers have known since 2007 that the function contains a weakness that gives knowledgeable adversaries the ability to decrypt encrypted communications that rely on it. Juniper officials have never disclosed the origins of the secret backdoor, which dated back to 2012 in some products.

Wednesday's update patching the certificate validation failure was just one of a half-dozen vulnerabilities fixed in Juniper products. The company rated the risk level of VPN weakness "medium" compared with "high" for several of the other vulnerabilities.